linux: Open files with `O_CLOEXEC` to not leak fds to child processes #446

Merged

ids1024 merged 1 commit from cloexec into master

2022-08-21 13:40:40 -05:00

ids1024 commented

2022-08-19 20:47:49 -05:00

(Migrated from github.com)

In general, open() should always be called with O_CLOEXEC, except immediately before an exec* call that will use the fd.

Previously the fd was leaked to a child process, as seen here:


int main() {
    assert(hid_open_path("/dev/hidraw0") > 0);
    char *args[] = {"/bin/sh", "-c", "readlink /proc/self/fd/*", NULL};
    execve("/bin/sh", args, NULL);
}

In some cases this could be a security issue if child processes may be less privileged and shouldn't have access to the file.

In general, `open()` should always be called with `O_CLOEXEC`, except immediately before an `exec*` call that will use the fd. Previously the fd was leaked to a child process, as seen here: ```c int main() { assert(hid_open_path("/dev/hidraw0") > 0); char *args[] = {"/bin/sh", "-c", "readlink /proc/self/fd/*", NULL}; execve("/bin/sh", args, NULL); } ``` In some cases this could be a security issue if child processes may be less privileged and shouldn't have access to the file.

Youw (Migrated from github.com) approved these changes

2022-08-20 04:11:23 -05:00

Youw (Migrated from github.com) left a comment